From: "Darrick J. Wong" <djwong@kernel.org>
To: Christian Brauner <christian.brauner@ubuntu.com>
Cc: "Alexander Viro" <viro@zeniv.linux.org.uk>,
"Christoph Hellwig" <hch@lst.de>,
linux-fsdevel@vger.kernel.org,
"John Johansen" <john.johansen@canonical.com>,
"James Morris" <jmorris@namei.org>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Dmitry Kasatkin" <dmitry.kasatkin@gmail.com>,
"Stephen Smalley" <stephen.smalley.work@gmail.com>,
"Casey Schaufler" <casey@schaufler-ca.com>,
"Arnd Bergmann" <arnd@arndb.de>,
"Andreas Dilger" <adilger.kernel@dilger.ca>,
"OGAWA Hirofumi" <hirofumi@mail.parknet.co.jp>,
"Geoffrey Thomas" <geofft@ldpreload.com>,
"Mrunal Patel" <mpatel@redhat.com>,
"Josh Triplett" <josh@joshtriplett.org>,
"Andy Lutomirski" <luto@kernel.org>,
"Theodore Tso" <tytso@mit.edu>, "Alban Crequy" <alban@kinvolk.io>,
"Tycho Andersen" <tycho@tycho.ws>,
"David Howells" <dhowells@redhat.com>,
"James Bottomley" <James.Bottomley@hansenpartnership.com>,
"Seth Forshee" <seth.forshee@canonical.com>,
"Stéphane Graber" <stgraber@ubuntu.com>,
"Linus Torvalds" <torvalds@linux-foundation.org>,
"Aleksa Sarai" <cyphar@cyphar.com>,
"Lennart Poettering" <lennart@poettering.net>,
"Eric W. Biederman" <ebiederm@xmission.com>,
smbarber@chromium.org, "Phil Estes" <estesp@gmail.com>,
"Serge Hallyn" <serge@hallyn.com>,
"Kees Cook" <keescook@chromium.org>,
"Todd Kjos" <tkjos@google.com>,
"Paul Moore" <paul@paul-moore.com>,
"Jonathan Corbet" <corbet@lwn.net>,
containers@lists.linux-foundation.org,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
linux-ext4@vger.kernel.org, linux-xfs@vger.kernel.org,
linux-integrity@vger.kernel.org, selinux@vger.kernel.org
Subject: Re: [PATCH v6 39/40] xfs: support idmapped mounts
Date: Mon, 1 Mar 2021 12:05:20 -0800 [thread overview]
Message-ID: <20210301200520.GK7272@magnolia> (raw)
In-Reply-To: <20210121131959.646623-40-christian.brauner@ubuntu.com>
On Thu, Jan 21, 2021 at 02:19:58PM +0100, Christian Brauner wrote:
> From: Christoph Hellwig <hch@lst.de>
>
> Enable idmapped mounts for xfs. This basically just means passing down
> the user_namespace argument from the VFS methods down to where it is
> passed to the relevant helpers.
>
> Note that full-filesystem bulkstat is not supported from inside idmapped
> mounts as it is an administrative operation that acts on the whole file
> system. The limitation is not applied to the bulkstat single operation
> that just operates on a single inode.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
> ---
> /* v2 */
>
> /* v3 */
>
> /* v4 */
>
> /* v5 */
> base-commit: 7c53f6b671f4aba70ff15e1b05148b10d58c2837
>
> /* v6 */
> unchanged
> base-commit: 19c329f6808995b142b3966301f217c831e7cf31
> ---
> fs/xfs/xfs_acl.c | 3 +--
> fs/xfs/xfs_file.c | 4 +++-
> fs/xfs/xfs_inode.c | 26 +++++++++++++++--------
> fs/xfs/xfs_inode.h | 16 +++++++++------
> fs/xfs/xfs_ioctl.c | 35 ++++++++++++++++++-------------
> fs/xfs/xfs_ioctl32.c | 6 ++++--
> fs/xfs/xfs_iops.c | 49 +++++++++++++++++++++++++-------------------
> fs/xfs/xfs_iops.h | 3 ++-
> fs/xfs/xfs_itable.c | 17 +++++++++++----
> fs/xfs/xfs_itable.h | 1 +
> fs/xfs/xfs_qm.c | 3 ++-
> fs/xfs/xfs_super.c | 2 +-
> fs/xfs/xfs_symlink.c | 5 +++--
> fs/xfs/xfs_symlink.h | 5 +++--
> 14 files changed, 110 insertions(+), 65 deletions(-)
<snip> Sorry for not noticing until after this went upstream, but...
> diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
> index 16ca97a7ff00..ca310a125d1e 100644
> --- a/fs/xfs/xfs_itable.c
> +++ b/fs/xfs/xfs_itable.c
> @@ -54,10 +54,12 @@ struct xfs_bstat_chunk {
> STATIC int
> xfs_bulkstat_one_int(
> struct xfs_mount *mp,
> + struct user_namespace *mnt_userns,
> struct xfs_trans *tp,
> xfs_ino_t ino,
> struct xfs_bstat_chunk *bc)
> {
> + struct user_namespace *sb_userns = mp->m_super->s_user_ns;
> struct xfs_icdinode *dic; /* dinode core info pointer */
> struct xfs_inode *ip; /* incore inode pointer */
> struct inode *inode;
> @@ -86,8 +88,8 @@ xfs_bulkstat_one_int(
> */
> buf->bs_projectid = ip->i_d.di_projid;
> buf->bs_ino = ino;
> - buf->bs_uid = i_uid_read(inode);
> - buf->bs_gid = i_gid_read(inode);
> + buf->bs_uid = from_kuid(sb_userns, i_uid_into_mnt(mnt_userns, inode));
> + buf->bs_gid = from_kgid(sb_userns, i_gid_into_mnt(mnt_userns, inode));
> buf->bs_size = dic->di_size;
>
> buf->bs_nlink = inode->i_nlink;
> @@ -173,7 +175,8 @@ xfs_bulkstat_one(
> if (!bc.buf)
> return -ENOMEM;
>
> - error = xfs_bulkstat_one_int(breq->mp, NULL, breq->startino, &bc);
> + error = xfs_bulkstat_one_int(breq->mp, breq->mnt_userns, NULL,
> + breq->startino, &bc);
>
> kmem_free(bc.buf);
>
> @@ -194,9 +197,10 @@ xfs_bulkstat_iwalk(
> xfs_ino_t ino,
> void *data)
> {
> + struct xfs_bstat_chunk *bc = data;
> int error;
>
> - error = xfs_bulkstat_one_int(mp, tp, ino, data);
> + error = xfs_bulkstat_one_int(mp, bc->breq->mnt_userns, tp, ino, data);
> /* bulkstat just skips over missing inodes */
> if (error == -ENOENT || error == -EINVAL)
> return 0;
> @@ -239,6 +243,11 @@ xfs_bulkstat(
> };
> int error;
>
> + if (breq->mnt_userns != &init_user_ns) {
> + xfs_warn_ratelimited(breq->mp,
> + "bulkstat not supported inside of idmapped mounts.");
> + return -EINVAL;
Shouldn't this be -EPERM?
Or -EOPNOTSUPP?
Also, I'm not sure why bulkstat won't work in an idmapped mount but
bulkstat_single does? You can use the singleton version to stat inodes
that aren't inside the submount.
--D
> + }
> if (xfs_bulkstat_already_done(breq->mp, breq->startino))
> return 0;
>
> diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h
> index 96a1e2a9be3f..7078d10c9b12 100644
> --- a/fs/xfs/xfs_itable.h
> +++ b/fs/xfs/xfs_itable.h
> @@ -8,6 +8,7 @@
> /* In-memory representation of a userspace request for batch inode data. */
> struct xfs_ibulk {
> struct xfs_mount *mp;
> + struct user_namespace *mnt_userns;
> void __user *ubuffer; /* user output buffer */
> xfs_ino_t startino; /* start with this inode */
> unsigned int icount; /* number of elements in ubuffer */
> diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
> index c134eb4aeaa8..1b7b1393cab2 100644
> --- a/fs/xfs/xfs_qm.c
> +++ b/fs/xfs/xfs_qm.c
> @@ -787,7 +787,8 @@ xfs_qm_qino_alloc(
> return error;
>
> if (need_alloc) {
> - error = xfs_dir_ialloc(&tp, NULL, S_IFREG, 1, 0, 0, ipp);
> + error = xfs_dir_ialloc(&init_user_ns, &tp, NULL, S_IFREG, 1, 0,
> + 0, ipp);
> if (error) {
> xfs_trans_cancel(tp);
> return error;
> diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> index 813be879a5e5..e95c1eff95e0 100644
> --- a/fs/xfs/xfs_super.c
> +++ b/fs/xfs/xfs_super.c
> @@ -1912,7 +1912,7 @@ static struct file_system_type xfs_fs_type = {
> .init_fs_context = xfs_init_fs_context,
> .parameters = xfs_fs_parameters,
> .kill_sb = kill_block_super,
> - .fs_flags = FS_REQUIRES_DEV,
> + .fs_flags = FS_REQUIRES_DEV | FS_ALLOW_IDMAP,
> };
> MODULE_ALIAS_FS("xfs");
>
> diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
> index 1f43fd7f3209..77c8ea3229f1 100644
> --- a/fs/xfs/xfs_symlink.c
> +++ b/fs/xfs/xfs_symlink.c
> @@ -134,6 +134,7 @@ xfs_readlink(
>
> int
> xfs_symlink(
> + struct user_namespace *mnt_userns,
> struct xfs_inode *dp,
> struct xfs_name *link_name,
> const char *target_path,
> @@ -223,8 +224,8 @@ xfs_symlink(
> /*
> * Allocate an inode for the symlink.
> */
> - error = xfs_dir_ialloc(&tp, dp, S_IFLNK | (mode & ~S_IFMT), 1, 0,
> - prid, &ip);
> + error = xfs_dir_ialloc(mnt_userns, &tp, dp, S_IFLNK | (mode & ~S_IFMT),
> + 1, 0, prid, &ip);
> if (error)
> goto out_trans_cancel;
>
> diff --git a/fs/xfs/xfs_symlink.h b/fs/xfs/xfs_symlink.h
> index b1fa091427e6..2586b7e393f3 100644
> --- a/fs/xfs/xfs_symlink.h
> +++ b/fs/xfs/xfs_symlink.h
> @@ -7,8 +7,9 @@
>
> /* Kernel only symlink definitions */
>
> -int xfs_symlink(struct xfs_inode *dp, struct xfs_name *link_name,
> - const char *target_path, umode_t mode, struct xfs_inode **ipp);
> +int xfs_symlink(struct user_namespace *mnt_userns, struct xfs_inode *dp,
> + struct xfs_name *link_name, const char *target_path,
> + umode_t mode, struct xfs_inode **ipp);
> int xfs_readlink_bmap_ilocked(struct xfs_inode *ip, char *link);
> int xfs_readlink(struct xfs_inode *ip, char *link);
> int xfs_inactive_symlink(struct xfs_inode *ip);
> --
> 2.30.0
>
next prev parent reply other threads:[~2021-03-01 20:56 UTC|newest]
Thread overview: 78+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-21 13:19 [PATCH v6 00/40] idmapped mounts Christian Brauner
2021-01-21 13:19 ` [PATCH v6 01/40] mount: attach mappings to mounts Christian Brauner
2021-01-21 13:19 ` [PATCH v6 02/40] fs: add id translation helpers Christian Brauner
2021-03-13 0:05 ` Vivek Goyal
2021-01-21 13:19 ` [PATCH v6 03/40] fs: add file and path permissions helpers Christian Brauner
2021-01-22 2:55 ` James Morris
2021-01-21 13:19 ` [PATCH v6 04/40] capability: handle idmapped mounts Christian Brauner
2021-01-22 2:57 ` James Morris
2021-01-21 13:19 ` [PATCH v6 05/39] namei: make permission helpers idmapped mount aware Christian Brauner
2021-01-22 3:02 ` James Morris
2021-01-22 22:26 ` J. Bruce Fields
2021-01-23 13:09 ` Christian Brauner
2021-01-24 22:18 ` J. Bruce Fields
2021-01-24 22:44 ` Christian Brauner
2021-01-21 13:19 ` [PATCH v6 06/40] inode: make init and " Christian Brauner
2021-01-22 3:10 ` James Morris
2021-01-21 13:19 ` [PATCH v6 07/40] attr: handle idmapped mounts Christian Brauner
2021-01-21 13:19 ` [PATCH v6 08/40] acl: " Christian Brauner
2021-01-21 13:19 ` [PATCH v6 09/40] xattr: " Christian Brauner
2021-01-22 3:21 ` James Morris
2021-01-21 13:19 ` [PATCH v6 10/40] commoncap: " Christian Brauner
2021-01-22 3:27 ` James Morris
2021-01-21 13:19 ` [PATCH v6 11/40] stat: " Christian Brauner
2021-01-22 3:28 ` James Morris
2021-01-21 13:19 ` [PATCH v6 12/40] namei: handle idmapped mounts in may_*() helpers Christian Brauner
2021-01-22 3:47 ` James Morris
2021-01-21 13:19 ` [PATCH v6 13/40] namei: introduce struct renamedata Christian Brauner
2021-01-21 13:19 ` [PATCH v6 14/40] namei: prepare for idmapped mounts Christian Brauner
2021-01-21 13:19 ` [PATCH v6 15/40] open: handle idmapped mounts in do_truncate() Christian Brauner
2021-01-22 17:20 ` Christoph Hellwig
2021-01-21 13:19 ` [PATCH v6 16/40] open: handle idmapped mounts Christian Brauner
2021-01-22 4:14 ` James Morris
2021-01-22 17:21 ` Christoph Hellwig
2021-01-21 13:19 ` [PATCH v6 17/40] af_unix: " Christian Brauner
2021-01-22 4:14 ` James Morris
2021-01-21 13:19 ` [PATCH v6 18/40] utimes: " Christian Brauner
2021-01-22 4:15 ` James Morris
2021-01-21 13:19 ` [PATCH v6 19/40] fcntl: " Christian Brauner
2021-01-22 4:17 ` James Morris
2021-01-21 13:19 ` [PATCH v6 20/40] init: " Christian Brauner
2021-01-22 17:23 ` Christoph Hellwig
2021-01-21 13:19 ` [PATCH v6 21/40] ioctl: " Christian Brauner
2021-01-22 4:33 ` James Morris
2021-01-21 13:19 ` [PATCH v6 22/40] would_dump: " Christian Brauner
2021-01-21 13:19 ` [PATCH v6 23/40] exec: " Christian Brauner
2021-01-22 4:35 ` James Morris
2021-01-25 16:39 ` Eric W. Biederman
2021-01-25 16:44 ` Christian Brauner
2021-01-25 17:03 ` Serge E. Hallyn
2021-01-25 17:06 ` Christian Brauner
2021-01-27 5:50 ` Serge E. Hallyn
2021-01-21 13:19 ` [PATCH v6 25/40] apparmor: " Christian Brauner
2021-01-21 13:19 ` [PATCH v6 26/39] ima: " Christian Brauner
2021-01-21 13:19 ` [PATCH v6 27/40] ecryptfs: do not mount on top of " Christian Brauner
2021-01-22 4:37 ` James Morris
2021-01-21 13:19 ` [PATCH v6 28/40] overlayfs: " Christian Brauner
2021-01-22 4:38 ` James Morris
2021-01-21 13:19 ` [PATCH v6 29/40] namespace: take lock_mount_hash() directly when changing flags Christian Brauner
2021-01-21 13:19 ` [PATCH v6 30/40] mount: make {lock,unlock}_mount_hash() static Christian Brauner
2021-01-21 13:19 ` [PATCH v6 31/40] namespace: only take read lock in do_reconfigure_mnt() Christian Brauner
2021-01-21 13:19 ` [PATCH v6 32/40] fs: split out functions to hold writers Christian Brauner
2021-01-21 13:19 ` [PATCH v6 33/40] fs: add attr_flags_to_mnt_flags helper Christian Brauner
2021-01-21 13:19 ` [PATCH v6 34/40] fs: add mount_setattr() Christian Brauner
2021-01-21 13:19 ` [PATCH v6 35/40] fs: introduce MOUNT_ATTR_IDMAP Christian Brauner
2021-01-22 17:33 ` Christoph Hellwig
2021-01-22 17:34 ` Christoph Hellwig
2021-01-21 13:19 ` [PATCH v6 36/40] tests: add mount_setattr() selftests Christian Brauner
2021-01-21 13:19 ` [PATCH v6 37/40] fat: handle idmapped mounts Christian Brauner
2021-01-21 13:19 ` [PATCH v6 38/40] ext4: support " Christian Brauner
2021-01-21 13:19 ` [PATCH v6 39/40] xfs: " Christian Brauner
2021-03-01 20:05 ` Darrick J. Wong [this message]
2021-03-01 20:46 ` Christian Brauner
2021-03-03 7:01 ` Christoph Hellwig
2021-01-27 5:40 ` [PATCH v6 00/40] " Serge E. Hallyn
2021-03-03 13:24 ` [PATCH v6 09/40] xattr: handle " David Howells
2021-03-03 14:05 ` Christian Brauner
2021-03-03 14:45 ` David Howells
2021-03-03 16:15 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210301200520.GK7272@magnolia \
--to=djwong@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=adilger.kernel@dilger.ca \
--cc=alban@kinvolk.io \
--cc=arnd@arndb.de \
--cc=casey@schaufler-ca.com \
--cc=christian.brauner@ubuntu.com \
--cc=containers@lists.linux-foundation.org \
--cc=corbet@lwn.net \
--cc=cyphar@cyphar.com \
--cc=dhowells@redhat.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=ebiederm@xmission.com \
--cc=estesp@gmail.com \
--cc=geofft@ldpreload.com \
--cc=hch@lst.de \
--cc=hirofumi@mail.parknet.co.jp \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=josh@joshtriplett.org \
--cc=keescook@chromium.org \
--cc=lennart@poettering.net \
--cc=linux-api@vger.kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mpatel@redhat.com \
--cc=paul@paul-moore.com \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=seth.forshee@canonical.com \
--cc=smbarber@chromium.org \
--cc=stephen.smalley.work@gmail.com \
--cc=stgraber@ubuntu.com \
--cc=tkjos@google.com \
--cc=torvalds@linux-foundation.org \
--cc=tycho@tycho.ws \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).